EUVD-2026-81910
GHSA-mhp6-2rq5-c7vj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable web app but exploitation needs admin access (PR:H), no user interaction; unrestricted PHP upload to webroot yields full code execution as web server user (C/I/A:H), same authorization context so S:U.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely for data portability, to deploy and execute malicious code on the underlying application server host.
AnalysisAI
HortusFox-Web releases prior to 6.1 expose the Import/Export data-portability feature to arbitrary file write, letting an authenticated administrator execute OS commands as the web server user by slipping a PHP file into the web-accessible public directory. The flaw carries a CVSS 4.0 score of 8.6 (assessed as CVSS 3.1 AV:N/AC:L/PR:H/UI:N/C:H/I:H/A:H, high confidentiality, integrity and availability impact) and is gated behind administrator privileges plus the operator running an import of attacker-supplied data, so it is not remotely exploitable by an unauthenticated user on a default install. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated administrator account on HortusFox-Web prior to 6.1 and use of the Import/Export feature: the attacker supplies a crafted import archive in which a referenced icon/photo/attachment/gallery/inventory filename carries a PHP extension (.php/.php5/.php7/.php8/.phtml) or a path-traversal prefix, which the unpatched ImportModule copies verbatim into the web-accessible public_path() directory. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, high-quality RCE finding but its real-world priority is moderated by a hard precondition. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to HortusFox-Web 6.1 or later (vendor-released patch: v6.1, https://github.com/danielbrendel/hortusfox-web/releases/tag/v6.1), which incorporates upstream commit 1c7108f23fa30759d6f3bf62f0cfbf975bdc0a3b adding UtilsModule::checkUnsafeFileName() and applying it to all ImportModule copy() operations; see also the VulnCheck advisory https://www.vulncheck.com/advisories/hortusfox-web-remote-code-execution-via-import-export. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Vendor-released patch: 6.1. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today